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IN THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application. 

Please amend the claims as follows: 

1. (Currently Amended) A computer-implemented method comprising: 
maintaining a plurality of stored signatures in a data storage device, each signature 

being associated with one of a plurality of registered documents; 

intercepting packets being transmitted over a network between a source and a 

destination; 

reassembling the packets into an intercepted document complete flow, wherein the 
intercepted complete flow represents an ordered data stream of a communication between 
the source and the destination; 

extracting a reassembled object from the intercepted complete flow to determine a 
content type of the reassembled object; 

calculating a set of signatures associated with the intorcoptod document reassembled 
object based on the content type ; and 

comparing the set of signatures associated with the intorcoptod document reassembled 
object with the plurality of stored signatures to determine if the intorcoptod document 
reassembled object contains content associated with a registered document, wherein each 
registered document is associated with a user that requested registration of the document, the 
user being alerted if an attempt to transmit the registered document over a network is made 7 
whereby an a l ert o l omont is configured during the roquostod registration of the registered 
document, wherein a capture system that maintains the stored signatures is configured to 
a ll ow the intorcoptod document to bo forwarded from the capture system to its intended 
destination at a network node un l ess a capture ru l o prohibits forwarding the intorcoptod 
document based on the intorcoptod document inc l uding ono or more objects . 
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2. (Canceled) 

3. (Currently Amended) The method of claim 1, further comprising, if the 
comparison results in a match of at least one of the signatures in the set of signatures with one 
or more of the plurality of stored signatures, then detecting registered content from the 



4. (Canceled) 

5. (Currently Amended) The method of claim 3, further comprising halting delivery 
of the intercepted document complete flow . 

6. (Currently Amended) The method of claim 5, further comprising prompting the 
user that requested registration of the registered document for permission to deliver the 
intercepted document complete flow, receiving permission from the user, and completing 
delivery of the intercepted document complete flow in response to receiving permission. 

7. (Currently Amended) The method of claim 1, wherein calculating the set of 
signatures of the intorcoptod document reassembled object comprises calculating a plurality of 
hashes over one or more portions of the intorcoptod document reassembled object . 



registered document being contained in the '» 




reassembled object. 
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8. (Currently Amended) An apparatus comprising: 

a network interface module to connect the apparatus to a network; 

a signature database to store a first set of signatures, the first set of signatures being 
associated with a registered object, wherein the first set of signatures stored in the signature 
database is associated with a user who requested registration of the registered object; 

an object capture module to intercept packets being transmitted over the network 
between a source and a destination : 

an object assembly module to reassemble the packets into an intercepted object 
complete flow, wherein the intercepted complete flow represents an ordered data stream of 
a communication between the source and the destination; 

an object classification module to extract a reassembled object from the intercepted 
complete flow to determine a content type of the reassembled object ; and 

a registration module comprising a registration engine to generate a second set of 
signatures based on the content type, the second set of signatures being associated with the 
intercepted reassembled object, and a search engine to compare the second set of signatures 
with the first set of signatures, the apparatus being configured to alert the user if an attempt to 
transmit the registered object document over a network is made , whereby an a l ert e l ement is 
configured during the requested registration of the registered document, wherein the object 
capture modu l o is configured to a ll ow an intercepted document that inc l udes the intercepted 
object to bo forwarded to its intended destination at a network node un l ess a capture ru l e 
prohibits forwarding the intercepted document based on the intercepted document inc l uding 
one or more objects . 



9. (Canceled) 
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10. (Previously Presented) The apparatus of claim 8, wherein the registration 
module detects registered content from the registered object being transmitted over the 
network if the search engine matches one or more signatures in the second set of signatures 
with one or more signatures in the first set of signatures. 

11. (Previously Presented) The apparatus of claim 10, wherein the registration 
module further comprises a notification module to generate an alert for the user who 
requested registration of the registered object in response to detecting registered content from 
the registered object being transmitted over the network. 

12. (Currently Amended) The apparatus of claim 8, further comprising an object 
store module to store the intercepted reassembled object. 

13. (Currently Amended) The apparatus of claim 12, wherein the registration 
module halts delivery of the intercepted object complete flow from the object store module to 
its the destination in response to detecting registered content from the registered object being 
transmitted over the network. 

14. (Currently Amended) The apparatus of claim 13, wherein the registration 
module allows completion of the delivery of the intercepted object complete flow from the 
object store module to rts the destination in response to receiving permission from the user 
who requested registration of the registered object. 



15. (Currently Amended) The apparatus of claim 8, wherein the registration engine 
generates the second set of signatures by calculating a plurality of hashes over various portions 
of the intercepted reassembled object. 



ATTORNEY DOCKET NO. 
06897. P007 
Confirmation No. 8137 



6 



PATENT APPLICATION 
10/815,239 



16. (Currently Amended) A machine-readable medium storing a sequence of 
instructions that, when executed by a processor, cause the processor to perform operations 
comprising: 

maintaining a plurality of stored signatures in a data storage device, each signature 
being associated with one of a plurality of registered documents objects , wherein each 
registered document object is associated with a user that requested registration of the object 
document ; 

intercepting packets being transmitted over a network between a source and a 
destination; 

reassembling the packets into an intercepted object complete flow, wherein the 
intercepted complete flow represents an ordered data stream of a communication between 
the source and the destination: 

extracting a reassembled object from the intercepted complete flow to determine a 
content type of the reassembled object; 

calculating a set of signatures associated with the intercepted object reassembled 
object based on the content type ; 

comparing the set of signatures associated with the intercepted object reassembled 
object with the plurality of stored signatures to determine if the intercepted document 
reassembled object contains content associated with a registered document; and 

alerting the user if an attempt to transmit the registered document over a network is 
made , whereby an a l ert e l ement is configured during the requested registration of the 
registered document, wherein a capture system that maintains the stored signatures is 
configured to a ll ow an intercepted document that inc l udes the intercepted object to bo 
forwarded from the capture system to its intended destination at a network node un l ess a 
capture ru l e prohibits forwarding the intercepted document based on the intercepted 
document inc l uding one or more objects . 
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17. (Canceled) 

18. (Currently Amended) The machine-readable medium of claim 16, wherein the 
instruction instructions further cause the processor to detect registered content from the 
registered document object being contained in the intercepted reassembled object, if the 
comparison results in a match of at least one of the signatures in the set of signatures with one 
or more of the plurality of stored signatures. 

19. (Currently Amended) The machine-readable medium of claim 18, wherein the 
instructions further cause the processor to halt delivery of the intercepted reassembled object. 

20. (Canceled) 

21. (Currently Amended) The machine-readable medium of claim 19, wherein the 
instructions further cause the processor to prompt the user that requested registration of the 
registered object document for permission to deliver the intercepted reassembled object, and 
to deliver the intercepted object complete flow if permission is given. 
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22. (Currently Amended) A machine-readable medium storing a sequence of 
instructions that, when executed by a processor, cause the processor to perform operations 
comprising: 

receiving a document to be registered; 

calculating a set of one or more signatures for the document , based on a content type 
of the document; 

storing the set of signatures in a database for comparison against signatures of captured 
documents, wherein the captured documents represent reassembled objects extracted from 
an ordered stream of data representing a communication between a source and a 
destination, wherein the set of signatures is associated with a user that requested registration 
of the document; and 

alerting the user if an attempt to transmit the registered document over a network is 
made, whereby an alert mechanism is configured by the user during the requested registration 
of the registered document , whoroin a capture system that maintains the stored signatures is 
configured to a ll ow the document to bo forwarded from the capture system to its intended 
destination at a network node un l ess a capture rule prohibits forwarding the document based 
on the intercepted document inc l uding one or more objects . 

23. (Canceled) 

24. (New) The computer-implemented method of claim 1, wherein the intercepted 
complete flow includes a plurality of reassembled objects. 

25. (New) The apparatus of claim 8, wherein the intercepted complete flow includes 
a plurality of reassembled objects. 

26. (New) The machine-readable medium of claim 16, wherein the intercepted 
complete flow includes a plurality of reassembled objects. 



